Event Message:

Windows 2000 is shutting down. All logon sessions will be terminated by this shutdown.

Source

Event Log

Event ID

Event Type

Security

Security

513

Success Audit

Explanation:

This event record indicates that the system is being shut down in an orderly fashion. This is not a guarantee that the system successfully shut down before power was turned off or the system stopped, because once the system has shut down it cannot write the fact that it has shut down to the log.